GRS Fleet Telematics

Fleet Tracking Regulations Explained: A Guide for Maintenance Providers in France

By Michael Bar5 min read
Fleet Tracking Regulations Explained: A Guide for Maintenance Providers in France

Jurisdiction Scope

France; employment-vehicle geolocation and connected-vehicle location-data processing under French data-protection law.

Overview of Fleet Tracking Laws

Applicable Business Type

Maintenance providers and field-service businesses operating company vehicles and tracking technicians’ journeys or interventions.

Country or Region

France

A France-focused compliance guide for maintenance providers using vehicle geolocation or connected-vehicle tracking. It covers employee privacy, lawful purposes, information and consultation duties, retention, access controls, off-duty deactivation, and the newer CNIL framework for connected-vehicle location data.

Legal Requirements Summary

Maintenance providers in France must treat vehicle tracking as a regulated personal-data processing activity. Tracking must have a valid, proportionate purpose and legal basis, with prior workforce consultation/information, employee rights and off-duty privacy controls. Retention is purpose-dependent—generally up to 2 months, 1 year for route optimisation or proof of interventions, and 5 years for working-time monitoring. Systems must be secured and documented, and CNIL’s 2026 connected-vehicle recommendation adds a consent analysis for user location data. Continuous or excessive monitoring can attract CNIL enforcement.

Main Regulatory Topics

  • Data Privacy and GDPR compliance
  • Lawful purpose and proportionality
  • Employee information and representative-body consultation
  • Driver/employee rights and off-duty deactivation
  • Record-keeping and retention
  • Installation and supplier security standards
  • Real-time tracking controls
  • Connected-vehicle location consent
  • CNIL enforcement and penalties

Key Compliance Obligations

  • Define a specific, lawful and proportionate purpose; do not use tracking for permanent employee surveillance, speed-limit enforcement, or tracking outside working time.
  • Inform or consult employee representative bodies before deciding to install the system.
  • Give employees prior information about the controller, purposes, legal basis, recipients, retention period, rights, and CNIL complaint route.
  • Allow employees to access and correct their tracking data and, where private use is possible, disable location collection outside working hours.
  • Apply data minimisation and retain data only for the applicable purpose-based period.
  • Secure live-tracking access with appropriate authentication and confidentiality controls.
  • Record the processing in the employer’s register of processing activities and involve the DPO where one exists.
  • Use appropriate processor contracts and verify suppliers’ security and confidentiality compliance.
  • For connected-vehicle services, identify whether user consent is required and configure activation, scope and duration of location collection accordingly.

Driver Consent Requirement

Consent Rule: Prior employee consent is not stated as a general prerequisite for employer fleet tracking. Instead, the employer must establish a lawful purpose and legal basis, consult or inform employee representatives before deployment, inform each employee before installation, respect opposition rights, and allow tracking to be disabled outside working hours where private use is possible. For connected-vehicle services involving a user’s location data, CNIL’s 2026 recommendation states that consent is generally required unless the data is necessary for a service expressly requested by the user.

Data Retention Period

Minimum Retention: No single universal period: normally no more than 2 months; up to 1 year when needed to optimise routes or prove interventions; up to 5 years when used for working-time monitoring.

Enforcement Authorities

  • Commission nationale de l’informatique et des libertés (CNIL), France’s data-protection supervisory and enforcement authority
  • Employee representative bodies, which must be informed or consulted before deployment where applicable
  • Relevant courts and labour authorities may also become involved in employment disputes, but the cited fleet-tracking guidance identifies the CNIL as the principal privacy regulator

Penalties for Non-Compliance

Non-compliance can lead to CNIL investigations, corrective orders and administrative fines, as well as employee complaints and litigation risk. The CNIL reported ten simplified-procedure sanctions in 2025 totalling €104,000, and it previously fined vehicle-rental company UBEEQO INTERNATIONAL €175,000 for disproportionate, near-continuous customer geolocation and excessive retention. Typical risk areas for a maintenance provider include excessive collection or retention, inadequate transparency, failure to provide off-duty disabling, and using tracking for impermissible employee surveillance.

Implementation Best Practices

For a maintenance provider, configure tracking around dispatching, route optimisation, proof of intervention and vehicle security rather than employee surveillance. Maintain a written data-protection impact/risk assessment where the scale or intrusiveness warrants it; document purpose, legal basis, collection frequency, retention schedule, access roles, supplier instructions and international transfers. Prefer retaining only the latest position when that meets the objective, anonymise data when identifiable history is no longer needed, and encrypt data both in transit and at rest. Build a work/off-duty switch into the system, test it, and retain auditable records of notices, representative consultation, access requests and deletion or anonymisation.

Compliance Checklist

  1. Define and document a specific lawful purpose and legal basis before deployment; do not assume employee consent is required or sufficient.
  2. Inform and, where applicable, consult employee representative bodies before installation.
  3. Give each employee clear prior information covering the controller, purposes, legal basis, data categories, recipients, retention, rights and CNIL complaint route.
  4. Limit collection frequency, history and fields to what is necessary for each purpose; justify any continuous or high-frequency tracking.
  5. Provide a way to disable location collection/transmission outside working time where vehicles may be used privately.
  6. Do not use tracking to monitor employees continuously, check speed-limit compliance, track union/employee representatives during their mandate, or calculate working time where another system exists.
  7. Apply purpose-based retention: ordinarily no more than two months; up to one year for route optimisation or proving interventions where no less intrusive evidence exists; up to five years for working-time monitoring, subject to the stated conditions.
  8. Record the processing in the organisation’s processing-activities register and involve the DPO where one exists.
  9. Restrict access, establish permissions and audit logs, and encrypt location data in transit and at rest.
  10. Provide access and rectification mechanisms and a process for handling objections and complaints.

Industry-Specific Guidance

Maintenance providers typically need location data to allocate engineers, optimise routes, evidence attendance at customer sites and manage vehicles. Those operational purposes do not create a general French requirement for permanent real-time tracking: the system must remain necessary and proportionate to each purpose. If tracking is used to prove a maintenance intervention, CNIL guidance permits retention for up to one year where alternative evidence is unavailable; ordinary location data should generally not be retained beyond two months. Engineers must be able to stop collection outside working hours where a company vehicle can be used privately. If the provider processes location data for a customer (for example, a fleet owner), the parties should clearly allocate controller/processor responsibilities and ensure the employee-facing information reaches the actual drivers.

Recent Legal Updates

On 16 April 2026, the CNIL adopted Recommendation 2026-063 on connected-vehicle location data; the published recommendation is dated June 2026. It treats vehicle-location data as highly privacy-intrusive and provides updated, non-prescriptive guidance on necessity, collection frequency, retention, access control and encryption. It recommends that, where sufficient, each new location replace the previous one so only the latest position is retained. For maintenance operations, this reinforces minimisation and purpose-specific retention rather than imposing a blanket real-time tracking mandate. The recommendation should be read alongside the existing employee-vehicle guidance and the GDPR/French Data Protection Act; it is guidance, not a new statute.

Authoritative Resources

Related reading

More from the blog.

Talk to GRS

Tell us about your fleet.

Get a package recommendation, transparent pricing and a practical deployment route.

Book a demoView resources